vulnerability-triage

Vulnerability Triage

Use this Skill when analyzing eco-guardian findings, JSON reports, SARIF reports, baseline behavior, or policy gate failures.

Prioritization

1. Critical findings with available fixed versions
2. High findings in direct dependencies
3. Policy gate failures (exit code 3)
4. Findings without fixed versions — recommend package replacement or mitigation
5. Transitive findings that can be fixed by upgrading parent packages

Summarizing findings

• Group by severity (critical → high → moderate → low)
• For each finding include: ecosystem, package, installed version, advisory ID, fixed version, affected paths (when available)
• Distinguish direct vs transitive dependencies when the data supports it
• Explain exit codes: 0 = clean, 1 = findings found, 2 = runtime error, 3 = policy gate failure
• Do NOT recommend running generated fix scripts without human review
• Do NOT suggest suppressing findings unless the user explicitly asks about baselines

Report interpretation

• SARIF files can be uploaded to GitHub code scanning via github/codeql-action/upload-sarif
• HTML reports are human-readable and can be shared
• JSON reports are machine-readable and can be parsed for automation

Baseline awareness

• Baselines suppress known findings — they do NOT fix vulnerabilities
• A suppressed finding still exists; it is just hidden from output
• Baselines should be reviewed regularly for expiration